krb5: import Heimdal-597.121.1 AS/TGS client

Sync with most changes in AS/TGS client from Apple's Heimdal-597.121.1
(opensource.apple.com).

Changes include:

 - FAST support in TGS client
 - Refactored pre-auth client to be more easily extensible
 - Pin KDC host and AD site name in API calls

Note the completely refactored TGS client loop is not imported as that was
considered too intrusive.

lib/base/heimbasepriv.h

@@ -64,6 +64,7 @@ enum {
     HEIM_TID_ERROR = 133,
     HEIM_TID_DATA = 134,
     HEIM_TID_DB = 135,
+    HEIM_TID_PA_AUTH_MECH = 136,
     HEIM_TID_USER = 255
 
 };